@johnnyboy11234/esg-idea-contest 0.2.0 → 0.2.1

package/backend/internal/auth/session_integration_test.go

@@ -0,0 +1,245 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/base64"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+const bcryptHash = "$2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234" // shape only; satisfies ck_app_user_hash
+
+func addUser(t *testing.T, db *sql.DB, empNo, role string, enabled bool) uuid.UUID {
+	t.Helper()
+	id := uuid.New()
+	var email any = empNo + "@example.com"
+	if role == "ADMIN" {
+		email = nil
+	}
+	if _, err := db.Exec(`INSERT INTO app_user (id, emp_no, name, email, password_hash, role, enabled) VALUES (?,?,?,?,?,?,?)`,
+		id.String(), empNo, "N "+empNo, email, bcryptHash, role, enabled); err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+// age moves a session's timestamps into the past (DB time is the only clock,
+// so tests change the rows rather than the clock).
+func age(t *testing.T, db *sql.DB, id string, created, lastAccess time.Duration) {
+	t.Helper()
+	h, _ := auth.Binding(id)
+	if _, err := db.Exec(`UPDATE session SET created_at = NOW(6) - INTERVAL ? SECOND, last_access_at = NOW(6) - INTERVAL ? SECOND WHERE id_hash = ?`,
+		int(created.Seconds()), int(lastAccess.Seconds()), h); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func lastAccess(t *testing.T, db *sql.DB, id string) time.Time {
+	t.Helper()
+	h, _ := auth.Binding(id)
+	var ts time.Time
+	if err := db.QueryRow(`SELECT last_access_at FROM session WHERE id_hash = ?`, h).Scan(&ts); err != nil {
+		t.Fatal(err)
+	}
+	return ts
+}
+
+func TestSessions(t *testing.T) {
+	db := dbtest.New(t)
+	ctx := context.Background()
+	s := auth.New(db)
+	user := addUser(t, db, "100001", "USER", true)
+
+	create := func(t *testing.T, u uuid.UUID) string {
+		t.Helper()
+		id, err := s.Create(ctx, u)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	valid := func(t *testing.T, id string) bool {
+		t.Helper()
+		_, ok, err := s.Validate(ctx, id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return ok
+	}
+
+	t.Run("create stores only the SHA-256 and returns a 32-byte ID", func(t *testing.T) {
+		id := create(t, user)
+		raw, err := base64.RawURLEncoding.DecodeString(id)
+		if err != nil || len(raw) != 32 {
+			t.Fatalf("id %q: %d bytes, %v", id, len(raw), err)
+		}
+		sum := sha256.Sum256(raw)
+		var n int
+		if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, sum[:]).Scan(&n); err != nil || n != 1 {
+			t.Fatalf("hash row count = %d, %v", n, err)
+		}
+		if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, raw).Scan(&n); err != nil || n != 0 {
+			t.Fatalf("raw ID stored: %d, %v", n, err)
+		}
+	})
+
+	t.Run("every login gets a new ID", func(t *testing.T) {
+		if a, b := create(t, user), create(t, user); a == b {
+			t.Fatal("same ID twice")
+		}
+	})
+
+	t.Run("validate returns the principal with the role from app_user", func(t *testing.T) {
+		admin := addUser(t, db, "200001", "ADMIN", true)
+		p, ok, err := s.Validate(ctx, create(t, admin))
+		if err != nil || !ok {
+			t.Fatalf("validate: %v %v", ok, err)
+		}
+		want := security.Principal{UserID: admin, EmpNo: "200001", Role: security.RoleAdmin}
+		if p != want {
+			t.Fatalf("principal = %+v, want %+v", p, want)
+		}
+	})
+
+	t.Run("unknown and malformed IDs are not valid", func(t *testing.T) {
+		unknown := base64.RawURLEncoding.EncodeToString(make([]byte, 32))
+		for _, id := range []string{unknown, "", "garbage"} {
+			if valid(t, id) {
+				t.Errorf("%q accepted", id)
+			}
+		}
+	})
+
+	t.Run("matched rows count: a valid session that needs no refresh still validates", func(t *testing.T) {
+		id := create(t, user)
+		before := lastAccess(t, db, id)
+		for i := 0; i < 2; i++ {
+			if !valid(t, id) {
+				t.Fatalf("validate #%d failed although the row matched", i+1)
+			}
+		}
+		if after := lastAccess(t, db, id); !after.Equal(before) {
+			t.Fatalf("last_access_at moved inside the 60 s window: %v -> %v", before, after)
+		}
+	})
+
+	t.Run("refresh happens only when last access is older than 60 s", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 0, 59*time.Second)
+		before := lastAccess(t, db, id)
+		if !valid(t, id) || !lastAccess(t, db, id).Equal(before) {
+			t.Fatal("59 s old: must validate without writing")
+		}
+		age(t, db, id, 0, 61*time.Second)
+		before = lastAccess(t, db, id)
+		if !valid(t, id) || !lastAccess(t, db, id).After(before) {
+			t.Fatal("61 s old: must validate and refresh")
+		}
+	})
+
+	t.Run("idle timeout is 30 minutes", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 0, 29*time.Minute+50*time.Second)
+		if !valid(t, id) {
+			t.Fatal("29m50s idle must still be valid")
+		}
+		age(t, db, id, 0, 30*time.Minute+5*time.Second)
+		if valid(t, id) {
+			t.Fatal("30m05s idle must be expired")
+		}
+	})
+
+	t.Run("absolute timeout is 8 hours, even for an active session", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 7*time.Hour+59*time.Minute, 0)
+		if !valid(t, id) {
+			t.Fatal("7h59m old must still be valid")
+		}
+		age(t, db, id, 8*time.Hour+time.Minute, 0)
+		if valid(t, id) {
+			t.Fatal("8h01m old must be expired although just used")
+		}
+	})
+
+	t.Run("disabled user is rejected on the next request", func(t *testing.T) {
+		u := addUser(t, db, "100002", "USER", true)
+		id := create(t, u)
+		if !valid(t, id) {
+			t.Fatal("enabled user must validate")
+		}
+		if _, err := db.Exec(`UPDATE app_user SET enabled = FALSE WHERE id = ?`, u.String()); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, id) {
+			t.Fatal("disabled user must not validate")
+		}
+	})
+
+	t.Run("revoke is idempotent and ends only that session", func(t *testing.T) {
+		a, b := create(t, user), create(t, user)
+		for i := 0; i < 2; i++ {
+			if err := s.Revoke(ctx, a); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := s.Revoke(ctx, "garbage"); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, a) || !valid(t, b) {
+			t.Fatal("revoke must end a and leave b")
+		}
+	})
+
+	t.Run("revoke all ends every session of the user only", func(t *testing.T) {
+		u, other := addUser(t, db, "100003", "USER", true), addUser(t, db, "100004", "USER", true)
+		a, b, o := create(t, u), create(t, u), create(t, other)
+		if err := s.RevokeAll(ctx, u); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, a) || valid(t, b) || !valid(t, o) {
+			t.Fatal("RevokeAll must end the user's sessions and no others")
+		}
+	})
+
+	t.Run("purge removes expired sessions only", func(t *testing.T) {
+		u := addUser(t, db, "100005", "USER", true)
+		live, idle, old := create(t, u), create(t, u), create(t, u)
+		age(t, db, idle, time.Hour, time.Hour)
+		age(t, db, old, 9*time.Hour, 0)
+		n, err := s.Purge(ctx)
+		if err != nil || n < 2 {
+			t.Fatalf("purged %d, %v; want at least 2", n, err)
+		}
+		if !valid(t, live) {
+			t.Fatal("live session purged")
+		}
+		for _, id := range []string{idle, old} {
+			h, _ := auth.Binding(id)
+			var c int
+			if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, h).Scan(&c); err != nil || c != 0 {
+				t.Fatalf("expired row still present: %d, %v", c, err)
+			}
+		}
+	})
+
+	t.Run("deleting a user deletes the sessions", func(t *testing.T) {
+		u := addUser(t, db, "100006", "USER", true)
+		id := create(t, u)
+		if _, err := db.Exec(`DELETE FROM app_user WHERE id = ?`, u.String()); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, id) {
+			t.Fatal("session survived its user")
+		}
+	})
+}

package/backend/internal/auth/session_test.go

@@ -0,0 +1,36 @@
+package auth_test
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func TestBindingIsSHA256OfDecodedID(t *testing.T) {
+	raw := make([]byte, 32)
+	for i := range raw {
+		raw[i] = byte(i)
+	}
+	want := sha256.Sum256(raw)
+	got, ok := auth.Binding(base64.RawURLEncoding.EncodeToString(raw))
+	if !ok || string(got) != string(want[:]) {
+		t.Fatalf("Binding = %x, %v; want %x", got, ok, want)
+	}
+}
+
+func TestBindingRejectsMalformedIDs(t *testing.T) {
+	for name, id := range map[string]string{
+		"empty":      "",
+		"not base64": "!!!",
+		"too short":  base64.RawURLEncoding.EncodeToString(make([]byte, 31)),
+		"too long":   base64.RawURLEncoding.EncodeToString(make([]byte, 33)),
+		"padded":     base64.URLEncoding.EncodeToString(make([]byte, 32)),
+		"std alpha":  base64.StdEncoding.EncodeToString([]byte{0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff}),
+	} {
+		if _, ok := auth.Binding(id); ok {
+			t.Errorf("%s: %q accepted", name, id)
+		}
+	}
+}

package/backend/internal/server/api.go

@@ -3,6 +3,7 @@ package server
 import (
 	"net/http"
 
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 )
@@ -11,8 +12,14 @@ import (
 // module has not landed yet stay api.Unimplemented (501).
 type API struct {
 	api.Unimplemented
+	Account  account.Handler
 	Deadline deadline.Handler
 }
 
 // GetDeadline serves GET /deadline.
 func (a API) GetDeadline(w http.ResponseWriter, r *http.Request) { a.Deadline.GetDeadline(w, r) }
+
+// Register serves POST /auth/register.
+func (a API) Register(w http.ResponseWriter, r *http.Request, _ api.RegisterParams) {
+	a.Account.Register(w, r)
+}

package/backend/internal/server/errors.go

@@ -5,10 +5,8 @@ import (
 	"encoding/json"
 	"errors"
 	"log/slog"
+	"maps"
 	"net/http"
-	"net/netip"
-
-	"github.com/go-chi/chi/v5"
 
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
@@ -59,37 +57,24 @@ func (a ErrorAdapter) record(r *http.Request, e *web.Error) {
 	if outcome == "" {
 		outcome = audit.Denied
 	}
-	after, _ := json.Marshal(map[string]string{"reason": e.AuditReason}) // map of strings cannot fail
+	detail := map[string]string{}
+	maps.Copy(detail, e.AuditDetail)
+	detail["reason"] = e.AuditReason // the reason always wins over a detail key
+	after, _ := json.Marshal(detail) // map of strings cannot fail
 	ev := audit.Event{
 		Action:     audit.Action(e.AuditAction),
 		Outcome:    outcome,
 		TargetType: audit.TargetType(e.AuditTargetType),
 		TargetID:   e.AuditTargetID,
 		Method:     r.Method,
-		Route:      routeTemplate(r),
+		Route:      web.RoutePattern(r),
 		Status:     e.Status,
 		ErrorCode:  string(e.Code),
-		IP:         remoteIP(r),
+		IP:         web.ClientIP(r),
 		UserAgent:  r.UserAgent(),
-		After:      after,
-	}
-	a.Audit.RecordRejected(r.Context(), ev)
-}
 
-// routeTemplate is the matched chi pattern (/api/v1/ideas/{id}), never the raw
-// path, so IDs do not leak into the log and rows group by route.
-func routeTemplate(r *http.Request) string {
-	if rc := chi.RouteContext(r.Context()); rc != nil {
-		return rc.RoutePattern()
+		SubmittedEmpNo: e.AuditSubmittedEmpNo,
+		After:          after,
 	}
-	return ""
-}
-
-// remoteIP is the TCP peer. Trusted-proxy handling is not decided yet.
-func remoteIP(r *http.Request) netip.Addr {
-	ap, err := netip.ParseAddrPort(r.RemoteAddr)
-	if err != nil {
-		return netip.Addr{}
-	}
-	return ap.Addr().Unmap()
+	a.Audit.RecordRejected(r.Context(), ev)
 }

package/backend/internal/server/errors_test.go

@@ -96,3 +96,21 @@ func TestAdapterReasonWithoutActionStillAnswers(t *testing.T) {
 }
 
 func contains(s, sub string) bool { return strings.Contains(s, sub) }
+
+func TestAdapterCarriesSubmittedEmpNoAndDetail(t *testing.T) {
+	e := web.NewError(web.CodeEmpNoTaken, "taken")
+	e.AuditReason, e.AuditAction, e.AuditOutcome = "emp_no_taken", "AUTH_REGISTER", "FAILED"
+	e.AuditSubmittedEmpNo = "089290"
+	e.AuditDetail = map[string]string{"empNo": "089290", "reason": "must not override"}
+	f := &fakeRejecter{}
+
+	rec := serve(t, server.ErrorAdapter{Audit: f}, e)
+
+	if rec.Code != 409 || len(f.got) != 1 {
+		t.Fatalf("status %d rows %d", rec.Code, len(f.got))
+	}
+	g := f.got[0]
+	if g.Outcome != audit.Failed || g.SubmittedEmpNo != "089290" || string(g.After) != `{"empNo":"089290","reason":"emp_no_taken"}` {
+		t.Fatalf("event = %+v (after %s)", g, g.After)
+	}
+}

package/backend/internal/shared/db/intx_test.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"database/sql/driver"
 	"errors"
+	"fmt"
 	"net/http"
 	"testing"
 	"time"
@@ -221,3 +222,27 @@ func TestSQLStateClassNonMySQL(t *testing.T) {
 		t.Error("non-MySQL error must have no class and no contention")
 	}
 }
+
+func TestDuplicateKey(t *testing.T) {
+	dup := func(msg string) error { return fmt.Errorf("wrap: %w", &mysql.MySQLError{Number: 1062, Message: msg}) }
+	cases := []struct {
+		name string
+		err  error
+		key  string
+		ok   bool
+	}{
+		{"plain", dup("Duplicate entry 'a@b' for key 'uq_app_user_email'"), "uq_app_user_email", true},
+		{"table qualified", dup("Duplicate entry '1' for key 'app_user.uq_app_user_emp_no'"), "uq_app_user_emp_no", true},
+		{"value contains the marker", dup("Duplicate entry 'for key ''x' for key 'uq_a'"), "uq_a", true},
+		{"no key in message", dup("boom"), "", true},
+		{"unterminated", dup("Duplicate entry 'x' for key 'uq_a"), "uq_a", true},
+		{"other number", &mysql.MySQLError{Number: 1205}, "", false},
+		{"not a mysql error", errors.New("x"), "", false},
+	}
+	for _, tc := range cases {
+		key, ok := DuplicateKey(tc.err)
+		if key != tc.key || ok != tc.ok {
+			t.Errorf("%s: got (%q, %v), want (%q, %v)", tc.name, key, ok, tc.key, tc.ok)
+		}
+	}
+}

package/backend/internal/shared/db/mysqlerr.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"errors"
+	"strings"
 
 	"github.com/go-sql-driver/mysql"
 )
@@ -31,3 +32,28 @@ func sqlStateClass(err error) string {
 	}
 	return string(me.SQLState[:2])
 }
+
+const errDupEntry = 1062 // ER_DUP_ENTRY
+
+// DuplicateKey reports whether err is a unique-key violation (1062) and names
+// the violated key, as in "Duplicate entry 'x' for key 'uq_app_user_email'".
+func DuplicateKey(err error) (key string, ok bool) {
+	var me *mysql.MySQLError
+	if !errors.As(err, &me) || me.Number != errDupEntry {
+		return "", false
+	}
+	const marker = "for key '"
+	i := strings.LastIndex(me.Message, marker)
+	if i < 0 {
+		return "", true
+	}
+	rest := me.Message[i+len(marker):]
+	if j := strings.IndexByte(rest, '\''); j >= 0 {
+		rest = rest[:j]
+	}
+	// MariaDB may qualify the key with the table name ("app_user.uq_x").
+	if k := strings.LastIndexByte(rest, '.'); k >= 0 {
+		rest = rest[k+1:]
+	}
+	return rest, true
+}

package/backend/internal/shared/security/security.go

@@ -4,7 +4,11 @@
 // that any package may import it.
 package security
 
-import "context"
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
 
 // Role is an account role (PRD §3). Leader, Member and Applicant are relations
 // to one Idea, not roles.
@@ -34,7 +38,7 @@ const (
 // Principal is the caller resolved from a valid session. The role is read from
 // the account on every request, never copied into the session (PRD §6.5).
 type Principal struct {
-	UserID int64
+	UserID uuid.UUID
 	EmpNo  string
 	Role   Role
 }

package/backend/internal/shared/security/security_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"testing"
 
+	"github.com/google/uuid"
+
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
 )
 
@@ -12,7 +14,7 @@ func TestPrincipalRoundTrip(t *testing.T) {
 	if _, ok := security.PrincipalFrom(ctx); ok {
 		t.Fatal("empty context must have no principal")
 	}
-	want := security.Principal{UserID: 7, EmpNo: "A123", Role: security.RoleUser}
+	want := security.Principal{UserID: uuid.New(), EmpNo: "A123", Role: security.RoleUser}
 	got, ok := security.PrincipalFrom(security.WithPrincipal(ctx, want))
 	if !ok || got != want {
 		t.Fatalf("got %+v, %v", got, ok)
@@ -21,9 +23,9 @@ func TestPrincipalRoundTrip(t *testing.T) {
 
 func TestActorRole(t *testing.T) {
 	bg := context.Background()
-	user := security.Principal{UserID: 1, EmpNo: "U1", Role: security.RoleUser}
-	admin := security.Principal{UserID: 2, EmpNo: "A1", Role: security.RoleAdmin}
-	bad := security.Principal{UserID: 3, EmpNo: "X", Role: "ROOT"}
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	admin := security.Principal{UserID: uuid.New(), EmpNo: "A1", Role: security.RoleAdmin}
+	bad := security.Principal{UserID: uuid.New(), EmpNo: "X", Role: "ROOT"}
 
 	tests := []struct {
 		name string

package/backend/internal/shared/web/problem.go

@@ -41,6 +41,12 @@ type Error struct {
 	// AuditTargetType and AuditTargetID name the resource, when there is one.
 	AuditTargetType string
 	AuditTargetID   uuid.UUID
+	// AuditSubmittedEmpNo is the employee ID typed into a failed registration
+	// or login; the audit package sanitizes it before storing.
+	AuditSubmittedEmpNo string
+	// AuditDetail adds keys to the row's after_json beside "reason". Callers
+	// must not put secrets here.
+	AuditDetail map[string]string
 }
 
 func (e *Error) Error() string {

package/backend/internal/shared/web/request.go

@@ -0,0 +1,27 @@
+package web
+
+import (
+	"net/http"
+	"net/netip"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// RoutePattern is the matched chi pattern (/api/v1/ideas/{id}), never the raw
+// path, so IDs do not leak into the audit log and rows group by route. It is
+// empty when no route matched.
+func RoutePattern(r *http.Request) string {
+	if rc := chi.RouteContext(r.Context()); rc != nil {
+		return rc.RoutePattern()
+	}
+	return ""
+}
+
+// ClientIP is the TCP peer. Trusted-proxy handling is not decided yet.
+func ClientIP(r *http.Request) netip.Addr {
+	ap, err := netip.ParseAddrPort(r.RemoteAddr)
+	if err != nil {
+		return netip.Addr{}
+	}
+	return ap.Addr().Unmap()
+}

package/frontend/src/shared/text/index.ts

@@ -0,0 +1,93 @@
+// Implements PRD §6.2 clean-up and counting. The back end (Go) implements the
+// same rules; both run testdata/text-cleanup.json.
+// String.prototype.trim is NOT used: its whitespace set differs from Unicode
+// White_Space (it strips U+FEFF and keeps U+0085).
+
+export type Problem = '' | 'REQUIRED' | 'INVALID_FORMAT' | 'INVALID_NAME_CHARS' | 'OUT_OF_RANGE';
+
+export interface CheckResult {
+  cleaned: string;
+  problem: Problem;
+}
+
+/** Unicode White_Space property: 25 code points. */
+export function isWhitespace(cp: number): boolean {
+  return (
+    (cp >= 0x0009 && cp <= 0x000d) ||
+    cp === 0x0020 ||
+    cp === 0x0085 ||
+    cp === 0x00a0 ||
+    cp === 0x1680 ||
+    (cp >= 0x2000 && cp <= 0x200a) ||
+    cp === 0x2028 ||
+    cp === 0x2029 ||
+    cp === 0x202f ||
+    cp === 0x205f ||
+    cp === 0x3000
+  );
+}
+
+/** Characters that would end up in the expected filename (PRD §6.2 rule 8). */
+const FORBIDDEN_NAME_CHARS = /[/\\:*?"<>|]/;
+const CONTROL = /\p{Cc}/u;
+
+/** Length in Unicode code points (not UTF-16 units). */
+export function countCodePoints(s: string): number {
+  return Array.from(s).length;
+}
+
+/** Removes leading and trailing White_Space code points. */
+export function trimWhitespace(s: string): string {
+  const cps = Array.from(s);
+  let start = 0;
+  let end = cps.length;
+  while (start < end && isWhitespace(cps[start]!.codePointAt(0)!)) start++;
+  while (end > start && isWhitespace(cps[end - 1]!.codePointAt(0)!)) end--;
+  return cps.slice(start, end).join('');
+}
+
+/** NFC, trim, then every whitespace run becomes one ASCII space. */
+export function cleanName(s: string): string {
+  const trimmed = trimWhitespace(s.normalize('NFC'));
+  let out = '';
+  let inRun = false;
+  for (const ch of trimmed) {
+    if (isWhitespace(ch.codePointAt(0)!)) {
+      inRun = true;
+      continue;
+    }
+    if (inRun) {
+      out += ' ';
+      inRun = false;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+/** NFC, CRLF and CR become LF, then trim. */
+export function cleanSummary(s: string): string {
+  return trimWhitespace(s.normalize('NFC').replace(/\r\n/g, '\n').replace(/\r/g, '\n'));
+}
+
+function check(cleaned: string, max: number, name: boolean): Problem {
+  if (cleaned === '') return 'REQUIRED';
+  for (const ch of cleaned) {
+    if (CONTROL.test(ch) && (name || ch !== '\n')) return 'INVALID_FORMAT';
+  }
+  if (name && FORBIDDEN_NAME_CHARS.test(cleaned)) return 'INVALID_NAME_CHARS';
+  if (countCodePoints(cleaned) > max) return 'OUT_OF_RANGE';
+  return '';
+}
+
+/** Cleans a person / Idea name and reports its first problem; `max` is inclusive. */
+export function checkName(s: string, max: number): CheckResult {
+  const cleaned = cleanName(s);
+  return { cleaned, problem: check(cleaned, max, true) };
+}
+
+/** Cleans a summary and reports its first problem; `max` is inclusive. */
+export function checkSummary(s: string, max: number): CheckResult {
+  const cleaned = cleanSummary(s);
+  return { cleaned, problem: check(cleaned, max, false) };
+}

package/frontend/src/shared/text/text.test.ts

@@ -0,0 +1,22 @@
+import cleanup from 'testdata/text-cleanup.json';
+import { checkName, checkSummary, countCodePoints, trimWhitespace } from './index';
+
+describe('shared/text contract (testdata/text-cleanup.json)', () => {
+  it('has cases', () => {
+    expect(cleanup.cases.length).toBeGreaterThan(0);
+  });
+
+  it.each(cleanup.cases)('$id', (c) => {
+    const r = c.kind === 'name' ? checkName(c.input, c.max) : checkSummary(c.input, c.max);
+    expect(r.cleaned).toBe(c.want);
+    expect(countCodePoints(r.cleaned)).toBe(c.wantCount);
+    expect(r.problem).toBe(c.wantProblem);
+  });
+});
+
+describe('trimWhitespace', () => {
+  it('uses White_Space, not String.prototype.trim', () => {
+    expect(trimWhitespace('\u0085a\u0085')).toBe('a');
+    expect(trimWhitespace('a')).toBe('a');
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnnyboy11234/esg-idea-contest",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "ESG Idea Contest registration system: Go backend, React frontend and design documents (source distribution).",
   "license": "MIT",
   "author": "Brian Huang",